Analytics BIOC Low
✕

Uncommon msiexec execution of an arbitrary file from a remote location

Msiexec is the command-line utility for the Windows Installer. Adversaries may abuse msiexec.exe to proxy execution of malicious payloads from remote locations.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: System Binary Proxy Execution: Msiexec (T1218.007)
Detector tags: LOLBIN Execution Analytics
Attacker's goals:

Evading security controls and executing arbitrary files from the web.

Investigative actions:

Monitor the command-line arguments of msiexec.exe, For example, the command line msiexec /i http://some_domain.com/www/executable.msi can be legitimate or malicious. Check if the the URL that is encoded in the command line is trusted. Determine if the executed DLL or MSI file is known as legitimate. Confirm whether the initiating process is legitimate and if the user running it knows of its use. Note - the MSI executable can run from other LAN locations, the alert will raise on the WAN connection.

Test period:
N/A (single event)
Deduplication:
1 Day
1 variation:
  • Suspicious msiexec execution on an internet-facing endpoint Low